The Lab theme contains a local file inclusion flaw caused by improper handling of the filename supplied to an include or require statement. An attacker who can influence the value read by the theme may read arbitrary files from the web server, potentially revealing configuration data, credentials, or other sensitive content. This weakness can be exploited during normal operation and is categorized as CWE‑98, leading to confidentiality exposure and possible privilege escalation.

The vulnerability affects installations of the axiomthemes Lab WordPress theme versions up to and including 1.0.0. All sites running these builds are potentially exposed; newer releases are not impacted.

The CVSS score of 8.1 indicates a high severity, though the EPSS score of <1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack path likely involves manipulating a parameter that the theme passes directly to an include() call, which can be performed from the frontend or within the admin interface, depending on the theme’s configuration. Because it is local, a foothold is required on the host server or a user with elevated privileges to fully exploit the flaw.